Microsoft Certified: Windows Server Administrator Associate (beta) — Practice Set 1

Question 1

A branch office with unreliable WAN connectivity and limited physical security needs a local domain controller. The security team is concerned that if the server is stolen, an attacker could extract cached credentials. Which type of domain controller should you deploy to mitigate this risk while still providing local authentication?

Accepted Answer

An RODC holds a read-only copy of the AD DS database and, by default, does not cache user credentials except for accounts explicitly permitted by the Password Replication Policy, limiting exposure if the physical hardware is compromised. A writable DC with BitLocker (A) still allows full write access and broader credential caching if compromised while running. A global catalog with universal group caching (C) addresses WAN authentication latency, not credential theft risk. Holding the PDC Emulator role (D) is unrelated to physical security concerns.

Question 2

You suspect that FSMO role holders in your forest are experiencing issues after a domain controller was forcibly removed. Which two role types should you check for role placement and potential seizure? (Choose two.)

Accepted Answer

FSMO roles are split into forest-wide roles (Schema Master, Domain Naming Master) and domain-wide roles (RID Master, PDC Emulator, Infrastructure Master); these are the five roles that must be checked and potentially seized after an unplanned DC removal. There is no such thing as a 'Global Catalog coordinator' role (C) or a 'Quorum Owner' FSMO role (D) — quorum is a failover clustering concept, not an AD DS FSMO role.

Question 3

Your company has two divisions that operate as separate AD DS forests but need users in one forest to access shared resources in the other, without merging the forests. What should you configure?

Accepted Answer

A forest trust allows all domains in one forest to trust all domains in another forest, enabling cross-forest resource access without merging directories. A site link bridge (A) only affects replication topology within a single forest's sites. RODCs (C) are about credential security, not inter-forest trust. Universal group membership caching (D) speeds up logon in sites without a global catalog and has nothing to do with cross-forest access.

Question 4

Your organization has offices in three cities, each with its own subnet and local domain controllers in the same domain. Users complain that logons are sometimes authenticated by a DC in another city, causing delays. What should you configure to ensure clients authenticate against the closest DC?

Accepted Answer

AD DS sites, with IP subnets correctly associated to each site, allow clients to use DC Locator to find the nearest domain controller based on the client's subnet, reducing cross-WAN authentication traffic. Creating separate domains (B) is a far more disruptive and unnecessary structural change. Loopback processing (C) affects how Group Policy applies to a computer, not DC selection. A forest trust (D) applies to separate forests, not sites within one domain.

Question 5

You need an account that runs a scheduled Windows service across multiple servers, automatically manages its own complex password, and does not require manual password rotation or a stored credential. Which type of account should you use?

Accepted Answer

A Group Managed Service Account (gMSA) provides automatic password management and can be used across multiple servers, ideal for services that run on more than one host, and is the recommended approach for selecting and managing service accounts. A standard user account with a non-expiring password (A) violates security best practice by never rotating credentials. Local System (C) is a local machine identity, not usable for authenticating across multiple servers to network resources. A shared administrator account (D) violates least-privilege and auditability principles.

Question 6

You want to deploy a standard set of desktop wallpaper, mapped drives, and printer connections to users in a specific OU, applying them without requiring a logon script, and allowing users to still change the settings afterward if desired. What should you use?

Accepted Answer

Group Policy preferences deliver configuration items like drive mappings, printers, and desktop settings that apply once but remain user-editable afterward, unlike enforced Group Policy settings which are continuously reapplied and typically grayed out. Enforced Group Policy settings (B) would lock the configuration and prevent user changes. A startup script (C) can achieve some of this but lacks the granular, GUI-based preference management model. Fine-grained password policies (D) apply only to password/lockout settings, not desktop configuration.

Question 7

An administrator needs to run PowerShell commands on a remote server, and those commands must in turn access a network share on a third server using the administrator's own credentials. A direct remote session fails to access the third server. What should be configured to resolve this?

Accepted Answer

The scenario describes the classic PowerShell 'double-hop' problem, where credentials used to establish the first remote session cannot be forwarded to a second hop; enabling CredSSP or configuring Kerberos constrained/resource-based delegation solves this. JEA (A) restricts what commands a user can run in a session but does not solve credential delegation across hops. RD Gateway (C) is for tunneling RDP traffic, not PowerShell remoting. Windows Admin Center gateway mode (D) is a separate management architecture and does not itself resolve double-hop authentication in raw PowerShell remoting.

Question 8

You want to centrally apply Azure Policy-based configuration and extension management to on-premises Windows Server VMs, treating them similarly to native Azure VMs. What should you implement first?

Accepted Answer

Onboarding on-premises servers as Azure Arc-enabled servers projects them into Azure Resource Manager as resources, which is the prerequisite for applying Azure Policy-driven device configuration and deploying VM extensions on non-Azure machines. Azure Update Manager (B) manages updates but depends on Arc onboarding (or being a native Azure VM) to function on-premises. Windows Admin Center desktop mode (C) is a management console, not an Azure resource projection mechanism. Storage Replica (D) is unrelated — it replicates volumes for disaster recovery.

Question 9

You need to automate a recurring maintenance task, such as stopping a service and restarting an Azure VM on a schedule, without installing custom software on each server. What Azure feature should you use?

Accepted Answer

Azure Automation runbooks let you author and schedule PowerShell or Python workflows that run centrally in Azure to automate tasks like service restarts across VMs. Azure Bastion (B) provides secure RDP/SSH access to VMs without public IPs and does not run scheduled automation. Azure File Sync (C) synchronizes file shares. Data collector sets (D) are a Performance Monitor feature for capturing performance data, not for running automation tasks.

Question 10

A developer needs to run a nested Hyper-V lab inside a Hyper-V VM hosted on your Windows Server host. What must you configure on the parent VM to support this?

Accepted Answer

Nested virtualization must be enabled on the VM's virtual processor configuration to allow that VM to itself run Hyper-V and host further nested VMs. Enhanced Session Mode (A) improves the VM connection experience (clipboard, drive redirection) but doesn't enable nested hypervisors. GPU partitioning (C) shares a physical GPU across VMs and is unrelated to nested virtualization. Hyper-V Replica (D) is a DR replication feature for VMs, not a virtualization capability toggle.

Question 11

You need to provide temporary, tightly time-boxed RDP access to an Azure VM's management port only when an approved request is active, minimizing the VM's exposed attack surface. What should you configure?

Accepted Answer

Just-in-time (JIT) VM access, typically enabled through Microsoft Defender for Cloud, locks down inbound management ports and opens them only for a limited window after an approved request, minimizing exposure. Azure Bastion (A) provides a secure RDP/SSH gateway but doesn't itself implement time-boxed, request-based port opening the way JIT does. An availability set (C) is for VM fault-domain distribution, unrelated to access control. A VM scale set with autoscaling (D) manages capacity, not access security.

Question 12

You must provide disaster recovery for a critical Hyper-V VM to a secondary site with asynchronous, VM-level replication that does not depend on shared storage or a failover cluster. Which feature should you configure?

Accepted Answer

Hyper-V Replica provides asynchronous, VM-level replication to a secondary host or site over unreliable network links, without requiring shared storage or clustering. Storage Spaces Direct (A) pools local disks into shared storage for a cluster, a different architecture entirely. NIC Teaming (C) provides network adapter redundancy, not VM replication. Storage Replica in synchronous mode (D) replicates volumes in near real time but typically requires low-latency links and operates at the volume/storage layer rather than the VM layer.

Question 13

Your DNS servers are receiving external queries and you're concerned about cache poisoning attacks affecting the integrity of DNS responses. Which feature should you implement to cryptographically sign zone data?

Accepted Answer

DNSSEC adds cryptographic signatures to DNS zone data so resolvers can validate that responses have not been tampered with, directly mitigating cache poisoning and spoofing. Conditional forwarding (A) simply routes queries for specific domains to specific DNS servers and provides no integrity protection. DNS policies (B) control response behavior based on criteria like client subnet or time of day, not cryptographic validation. AD-integrated DNS (D) improves replication and security of zone transfers within AD DS but does not itself provide DNSSEC-style response validation for external queries.

Question 14

You want to ensure that if your primary on-premises DHCP server fails, clients can still obtain and renew IP address leases without manual intervention. What should you implement?

Accepted Answer

DHCP failover lets two DHCP servers share lease information and continue serving clients if one server becomes unavailable, providing high availability for DHCP. DNS forwarding (B) is unrelated to DHCP lease availability. A DHCP relay agent alone (C) forwards broadcast DHCP requests across subnets but does not provide redundancy if the DHCP server itself fails. IP address reservations (D) ensure a specific device always receives the same address but don't address server availability.

Question 15

Users at a branch office report that internal hostnames resolve correctly, but the same clients occasionally get connected to the wrong regional application endpoint compared to users at headquarters, even though both offices query the same DNS server. You want responses to differ based on the client's originating subnet. What should you configure?

Accepted Answer

DNS policies allow a single DNS server to return different responses to the same query based on criteria such as the client's subnet, enabling location-aware responses like regional endpoint steering. A DHCP scope (B) governs IP address assignment, not DNS response logic. A conditional forwarder (C) routes entire domain queries to another DNS server uniformly, not selectively by client location. An RODC (D) is a domain controller role and has no bearing on subnet-aware DNS responses.

Question 16

You are migrating an on-premises DFS Namespace deployment to a cloud-based file synchronization model while keeping a local cache of frequently accessed files on-premises. What should you implement?

Accepted Answer

Azure File Sync, with cloud tiering enabled, centralizes file data in Azure file shares while caching frequently used files locally on the Windows Server endpoint, which is the recommended migration path from DFS to Azure Files. Storage Replica (B) replicates block storage between servers or clusters, not a cloud file-sync/caching model. Data Deduplication (C) reduces storage consumption by eliminating duplicate blocks, unrelated to cloud synchronization. Storage Spaces Direct (D) pools local disks for a hyper-converged cluster and has no direct role in DFS-to-cloud migration.

Question 17

You need to enforce a quota on a file share and automatically notify administrators when usage nears the limit, as well as block specific file types like executables from being stored. What feature should you configure?

Accepted Answer

FSRM provides quota management, file screening (blocking file types), and reporting/notification capabilities for Windows Server file shares. SMB over QUIC (B) is a transport enhancement for secure SMB access over untrusted networks, unrelated to quotas. Storage QoS (C) manages storage performance/IOPS allocation, not quotas or file screening. ReFS integrity streams (D) protect against data corruption using checksums, not quota enforcement.

Question 18

You are designing storage for a Storage Spaces Direct hyper-converged cluster that requires high performance and resiliency without a SAN. Which two capabilities are most relevant to plan for? (Choose two.)

Accepted Answer

Storage Spaces Direct pools local, directly attached disks across cluster nodes into a single software-defined storage layer, and SMB Direct with RDMA-capable NICs is commonly used to deliver the low-latency, high-throughput network fabric that S2D relies on between nodes. DFS Namespace consolidation (C) is a separate file-sharing feature unrelated to the underlying storage fabric. DNSSEC (D) is a DNS security feature with no bearing on storage cluster performance or resiliency design.

Question 19

A volume containing sensitive data was encrypted with BitLocker, and the recovery key is required after a TPM state change flagged the drive as locked. Where would you look first to retrieve the recovery key if it was backed up to AD DS?

Accepted Answer

When BitLocker recovery information is backed up to AD DS, it is stored as a property of the associated computer object, and administrators can view it under a BitLocker Recovery tab in tools like Active Directory Users and Computers. DNS zone properties (B) have nothing to do with encryption keys. FSRM quota templates (C) manage storage quotas, not recovery keys. Storage Replica partnership logs (D) track replication status, not BitLocker recovery data.

Question 20

You want to prevent domain administrator credentials from being cached in a way that lets them be extracted using pass-the-hash or pass-the-ticket techniques when an admin signs in to a lower-trust server. Which feature should you implement?

Accepted Answer

Credential Guard uses virtualization-based security to isolate and protect secrets (such as NTLM hashes and Kerberos tickets) so that even a compromised OS kernel cannot extract them, directly mitigating pass-the-hash and pass-the-ticket attacks. SmartScreen (A) helps block malicious downloads and sites, not credential theft techniques. Windows Firewall connection security rules (C) govern IPsec-based traffic authentication, not in-memory credential protection. Exploit protection (D) mitigates memory-corruption exploitation techniques (like ASLR/DEP-style protections), which is a different threat category.

Question 21

You need to ensure local administrator account passwords on member servers are unique per machine, automatically rotated, and retrievable only by authorized administrators from AD DS. Which solution addresses this?

Accepted Answer

Windows LAPS automatically manages and rotates local administrator passwords per machine and stores them securely in AD DS (or Microsoft Entra ID), with access restricted through delegated permissions. The Protected Users group (B) restricts how a domain account's credentials can be used/cached but does not manage local admin passwords. Fine-grained password policies (C) apply different domain password/lockout policies to different sets of domain users, not local account passwords. OSConfig baselines (D) apply consistent security configuration baselines but don't perform local password rotation.

Question 22

Security auditors want assurance that even if a domain user's credentials are phished, the attacker cannot use NTLM to authenticate as that user and that the account's Kerberos tickets have a shortened lifetime. Which built-in group should the account be added to?

Accepted Answer

The Protected Users group applies restrictions such as disabling NTLM authentication, disabling DES/RC4 for Kerberos pre-auth, and enforcing shorter Kerberos ticket lifetimes for its members, hardening high-value accounts against credential theft and replay. Domain Admins (B) grants elevated privileges but applies no such credential-hardening restrictions by itself. Backup Operators (C) grants backup/restore rights and is unrelated to authentication hardening. Remote Management Users (D) grants WinRM access, not credential protections.

Question 23

You want to capture detailed performance counter data over a scheduled window (for example, CPU, memory, and disk counters every 15 seconds for 24 hours) for later trend analysis, without manually watching a live console. What should you configure?

Accepted Answer

Data collector sets in Performance Monitor let you define specific counters, sampling intervals, and schedules to capture performance data over time for later analysis, exactly matching the scenario. Event log subscriptions (B) forward Windows event log entries, not performance counter samples. VM Insights (C) is an Azure Monitor feature focused on Azure VM performance and dependency mapping, not local scheduled counter logging. System Insights (D) provides predictive capacity analytics on the server itself but is not the mechanism for defining custom scheduled counter captures.

Question 24

An administrator accidentally deleted an OU containing several user accounts. AD Recycle Bin is enabled. What is the appropriate recovery approach?

Accepted Answer

Since AD Recycle Bin is enabled, deleted objects (including their attributes and group memberships) can typically be restored directly and non-disruptively without needing to reboot a domain controller into Directory Services Restore Mode. DSRM authoritative restore (B) is a valid recovery technique but is more disruptive and generally reserved for scenarios where AD Recycle Bin isn't enabled or backups must be used. Manually recreating accounts (C) loses the original SIDs and group memberships. Forcing replication (D) would not restore already-replicated deletions and could propagate the deletion further.

Question 25

Users report intermittent failures accessing resources that require Kerberos authentication on a specific member server, even though the domain itself appears healthy. Other servers are unaffected. What should you investigate first?

Accepted Answer

Kerberos authentication failures isolated to a single member server, while the rest of the domain functions normally, are a classic symptom of a broken secure channel or computer account trust relationship (for example, after the machine account password fell out of sync), and should be investigated first with tools like Test-ComputerSecureChannel. The Schema Master (B) affects schema changes forest-wide and wouldn't cause a single-server authentication issue. DHCP scope options (C) affect IP configuration, not Kerberos trust. FSRM quotas (D) govern storage usage and are unrelated to authentication failures.

AZ-802 — Windows Server Administrator Associate (beta)